From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751693AbbK0Fo5 (ORCPT ); Fri, 27 Nov 2015 00:44:57 -0500 Received: from mailout4.samsung.com ([203.254.224.34]:54219 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750989AbbK0Foy (ORCPT ); Fri, 27 Nov 2015 00:44:54 -0500 X-AuditID: cbfee68f-f79666d0000076bb-dd-5657edd4cf90 Date: Fri, 27 Nov 2015 05:44:52 +0000 (GMT) From: =?euc-kr?B?sejBpLno?= Subject: [PATCH] driver:dma bug_fix : access freed memory To: sumit.semwal@linaro.org, gregkh@linuxfoundation.org, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, devel@driverdev.osuosl.org Reply-to: jb09.kim@samsung.com MIME-version: 1.0 X-MTR: 20151127053922385@jb09.kim Msgkey: 20151127053922385@jb09.kim X-EPLocale: ko_KR.euc-kr X-Priority: 3 X-EPWebmail-Msg-Type: personal X-EPWebmail-Reply-Demand: 0 X-EPApproval-Locale: X-EPHeader: ML X-MLAttribute: X-RootMTR: 20151127053922385@jb09.kim X-ParentMTR: X-ArchiveUser: EV X-CPGSPASS: N X-ConfirmMail: N,general Content-type: text/plain; charset=euc-kr MIME-version: 1.0 Message-id: <1606811477.1531761448603090175.JavaMail.weblogic@epmlwas01d> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprJJsWRmVeSWpSXmKPExsVy+t8zTd0rb8PDDD5eNrK4vGsOmwOjx+dN cgGMUQ2MNolFyRmZZakKqXnJ+SmZeem2SqEhbroWSgoZ+cUltkrRRgbGekamJnpGJuZ6lgax VkamSgp5ibmptkoVulC9SgpFyQVAtbmVxUADclL1oOJ6xal5KQ5Z+aUgl+gVJ+YWl+al6yXn 5yoplCXmlAKNUNJPmMqYMe2fYsE9lYqGuT4NjA+Uuxg5OYQElCWa9v9jBrElBEwkfj3fDWWL SVy4t56ti5ELqGYZo0TDwQ9MXYwcYEULD8tDxOcwSvxc94kJpIFFQFVi1dR37CA2m4CxxONV h8EGCQtYSnS0XWYGaRAR+Mco8eThVmaIzXIS3x8fBWvgFRCUODnzCQvEZkWJfQdXMUHElSRa zt9ig4hLSMyafoEVwuaVmNH+FKpeTmLa1zVQV0tLnJ+1gRHmg8XfH0PF+SWO3d7BBGELSEw9 cxCqRk1izqTfUDP5JNYsfAs1U1Di9LVuZphd97fMZYK5YWvLE7B6ZqA7p3Q/ZIewtSS+/NjH huoXDiDbU+LVrXiQ3yUEOjkk1ty7wgwJLAGJb5MPsUxgVJyFpGUWkrGzkIxFVrOAkWUVo2hq QXJBcVJ6kTFyZG9ihKTB/h2Mdw9YH2IU4GBU4uGVSA8PE2JNLCuuzD3EmAy0eiKzlGhyPjDZ 5pXEGxqbGVmYmpgaG5lbmmEIm5haWJgY4RBWEuddKPUzWEggPbEkNTs1tSC1KL6oNCe1+BAj EwenVAOj5oreta/ubi7hUu2dKvE3/+oSiTebZLm9tCKWfyybr5OoWhU5MTZk4jf7dFbGtJ77 zbNfPsqPf+rX5X7hkpeCW2LyKuc/tmfZv5t1by37ZDD3slJh0Nv9UsvSVTqi/2QrzbrGdUf8 wM2pyYl7GJyS+ALK7ojyzLl+MvPAIl3dZwe8t9xVLk9WYinOSDTUYi4qTgQAEPafR6wDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrFKsWRmVeSWpSXmKPExsVy+t/tXt0rb8PDDOYf1LO4vGsOmwOjx+dN cgGMURk2GamJKalFCql5yfkpmXnptkrewfHO8aZmBoa6hpYW5koKeYm5qbZKLj4Bum6ZOUBD lRTKEnNKgUIBicXFSvp2NkX5pSWpChn5xSW2StFGBsZ6RqYmekbGBnomBrFWhgYGRqZAVQkZ GdP+KRbcU6lomOvTwPhAuYuRk0NIQFmiaf8/5i5GDg4JAROJhYflQcISAmISF+6tZ+ti5AIq mcMo8XPdJyaQBIuAqsSqqe/YQWw2AWOJx6sOM4PYwgKWEh1tl5lBGkQE/jFKPHm4lRligZzE 98dHwRp4BQQlTs58wgKxQVFi38FVTBBxJYmW87fYIOISErOmX2CFsHklZrQ/haqXk5j2dQ0z hC0tcX7WBkaYSxd/fwwV55c4dnsHE4QtIDH1zEGoGjWJOZN+Q83kk1iz8C3UTEGJ09e6mWF2 3d8ylwnmhq0tT8DqmYHunNL9kB3C1pL48mMfG6pfOIBsT4lXt+InMMrMQpKZhaR7FpJuZDUL GFlWMYqmFiQXFCelV5joFSfmFpfmpesl5+duYgSnm2dLdjA2XLA+xCjAwajEw3sgJTxMiDWx rLgy9xCjBAezkggvJzBZCfGmJFZWpRblxxeV5qQWH2I0BcbURGYp0eR8YCrMK4k3NDYwNjS0 NDcwNTSyUBLnvb3PL0xIID2xJDU7NbUgtQimj4mDU6qBUUGlWZNlWetsKasame0hZRtjVk6Z edTkYKVuNpesP5/IpZpVlzfOs90s5MHItWHDGT61/t33t6dYyfZu3nny9cNJDbw9/ZNjn8++ 58m6eMJa11KbA5dD5ZOS2qLXl6ikK/xSEjtzYLH9mQ2bguTmTGuoWxXo1HXY0ZBpu/OW21e0 glfPvRHpr8RSnJFoqMVcVJwIAHwrm2VNAwAA DLP-Filter: Pass X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id tAR5j96M006716 >>From 8f6aeb362d9e44f29d46ae7694cdfee4408406ce Mon Sep 17 00:00:00 2001 From: "KIM JUGNBAE" Date: Thu, 26 Nov 2015 16:28:47 +0900 Subject: [PATCH] bug_fix : access freed memory sync_fenc_free & fence_check_cb_func would be executed at other cpu. fence_check_cb_func access freed fence memory after kfree(fence) at sync_fence_free. To escaped this issue, atomic_read(&fence->status) need to be protected by child_list_lock. Signed-off-by: "kimjungbae\" " " --- drivers/dma-buf/fence.c | 13 +++++++++++++ drivers/staging/android/sync.c | 10 +++++++--- drivers/staging/android/sync_debug.c | 2 ++ include/linux/fence.h | 1 + 4 files changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/dma-buf/fence.c b/drivers/dma-buf/fence.c index 7bb9d65..d40211e 100644 --- a/drivers/dma-buf/fence.c +++ b/drivers/dma-buf/fence.c @@ -310,6 +310,19 @@ fence_remove_callback(struct fence *fence, struct fence_cb *cb) } EXPORT_SYMBOL(fence_remove_callback); +bool +fence_remove_callback_locked(struct fence *fence, struct fence_cb *cb) +{ + bool ret; + + ret = !list_empty(&cb->node); + if (ret) + list_del_init(&cb->node); + + return ret; +} +EXPORT_SYMBOL(fence_remove_callback_locked); + struct default_wait_cb { struct fence_cb base; struct task_struct *task; diff --git a/drivers/staging/android/sync.c b/drivers/staging/android/sync.c index 83f640f..9b60542 100644 --- a/drivers/staging/android/sync.c +++ b/drivers/staging/android/sync.c @@ -518,12 +518,16 @@ static const struct fence_ops android_fence_ops = { static void sync_fence_free(struct kref *kref) { struct sync_fence *fence = container_of(kref, struct sync_fence, kref); - int i, status = atomic_read(&fence->status); + int i; + unsigned long flags; for (i = 0; i < fence->num_fences; ++i) { - if (status) - fence_remove_callback(fence->cbs[i].sync_pt, + spin_lock_irqsave(fence->cbs[i].sync_pt->lock, flags); + if (atomic_read(&fence->status)) + fence_remove_callback_locked(fence->cbs[i].sync_pt, &fence->cbs[i].cb); + spin_unlock_irqrestore(fence->cbs[i].sync_pt->lock, flags); + fence_put(fence->cbs[i].sync_pt); } diff --git a/drivers/staging/android/sync_debug.c b/drivers/staging/android/sync_debug.c index 0153cd2..e854f35 100644 --- a/drivers/staging/android/sync_debug.c +++ b/drivers/staging/android/sync_debug.c @@ -155,7 +155,9 @@ static void sync_print_fence(struct seq_file *s, struct sync_fence *fence) container_of(fence->cbs[i].sync_pt, struct sync_pt, base); + spin_lock_irqsave(pt->base.lock, flags); sync_print_pt(s, pt, true); + spin_unlock_irqrestore(pt->base.lock, flags); } spin_lock_irqsave(&fence->wq.lock, flags); diff --git a/include/linux/fence.h b/include/linux/fence.h index d174585..a5a3fd1 100644 --- a/include/linux/fence.h +++ b/include/linux/fence.h @@ -224,6 +224,7 @@ signed long fence_default_wait(struct fence *fence, bool intr, signed long timeo int fence_add_callback(struct fence *fence, struct fence_cb *cb, fence_func_t func); bool fence_remove_callback(struct fence *fence, struct fence_cb *cb); +bool fence_remove_callback_locked(struct fence *fence, struct fence_cb *cb); void fence_enable_sw_signaling(struct fence *fence); /** -- 1.7.9.5 {.n++%ݶw{.n+{G{ayʇڙ,jfhz_(階ݢj"mG?&~iOzv^m ?I